The Washington PostDemocracy Dies in Darkness

California begins enforcing digital privacy law, despite calls for delay

Measure took effect in January, with a six-month grace period

California Attorney General Xavier Becerra at a news conference last year in San Francisco. (Ben Margot/AP)

California’s privacy law, often called the broadest law for digital privacy in the United States, can finally be enforced starting Wednesday. And despite industry calls for the state to hold off because of the novel coronavirus pandemic, Attorney General Xavier Becerra is forging ahead.

“For sure we will start enforcing on July 1,” Becerra said in an interview.

The law went into effect Jan. 1 after a winding and sometimes surprising route through a voter ballot process, the state legislature and a contentious amendment period culminating in a final version last fall. It gives consumers in the state — and many outside California — broad ability to be able to request that companies tell them what personal data they hold on each person and to ask companies to stop selling their personal data to third-party advertisers or others. The law gave companies six months after it took effect before enforcement began, though Becerra noted that companies had to begin complying in January.

But that all hinges on people actually using the law, which puts the onus on consumers to initiate the process with companies. Becerra said his office has received some complaints about how companies are responding. He urged people to make it a habit to read the required disclosures on companies’ homepages every time they visit a new website.

Don’t sell my data! We finally have a law for that

Starting Wednesday, Becerra’s office is able to start sending businesses warnings that they might be in violation of the law and give them 30 days to fix the issues before facing possible fines or lawsuits.

More than two dozen trade associations and business groups asked the state in March to delay enforcement because of business disruptions caused by the pandemic. The letter, which was signed by the Interactive Advertising Bureau, the Internet Coalition and the California U.S. Chamber of Commerce, pointed out that the state-issued regulations for the law haven’t been finalized.

Becerra acknowledged the requests but noted that the law went into effect six months ago.

So far, under California’s new privacy law, firms are disclosing too little data — or far too much

“It’d be very awkward to continue another six months as some companies were requesting where people would have rights, companies would have obligations, but no one would be there to make sure those rights are being complied with,” he said.

Becerra declined to say whether the state will start issuing warning notices on Wednesday or which companies those might go to. The privacy law, known as CCPA, will probably receive another round of scrutiny later this year. During the November election, voters will consider a ballot measure from the same creator of CCPA, designed to follow up on the existing law.